2007

The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-depen

The compat_sys_mount function in fs/compat.c in Linux kernel 2.6.20 and earlier allows local users to cause a denial of

The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not

CRLF injection vulnerability in formmail.php in Jetbox CMS 2.1 might allow remote attackers to inject arbitrary e-mail h

Unspecified vulnerability in Ingate Firewall and SIParator before 4.5.2 allows remote authenticated users without full p

Xythos Enterprise Document Manager (XEDM), Digital Locker (XDL), and possibly WebFile Server before 6.0.46.1 allow remot

Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, an

Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, whic

eZ publish before 3.8.1 does not properly enforce permissions for "content edit Language" when there are four or more la

eZ publish before 3.8.5 does not properly enforce permissions for editing in a specific language, which allows remote au

WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field

vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data res

The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated u

WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive i

MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE L

Absolute path traversal vulnerability in a certain ActiveX control in PGPBBox.dll in EldoS SecureBlackbox (sbb) 5.1.0.11

The WYSIWYG editor applet in activeWeb contentserver CMS before 5.6.2964 only filters malicious tags from articles sent

activeWeb contentserver CMS before 5.6.2964 does not limit the file-creation ability of editors who have restricted acco

Cross-site scripting (XSS) vulnerability in takeprofedit.php in TBDev.NET DR 010306 and earlier allows remote attackers

The Samba server on Apple Mac OS X 10.3.9 and 10.4.10, when Windows file sharing is enabled, does not enforce disk quota

user.php in the Billing Control Panel in phpCoupon allows remote authenticated users to obtain Premium Member status, an

The management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allows remote authenticated administr

Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ

Babo Violent 2 2.08.00 does not validate the sender field of a chat message composed by a client, which allows remote au

The Services API in Firebird before 2.0.2 allows remote authenticated users without SYSDBA privileges to read the server

The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 "relies on user space

Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and

Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 an

Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete

The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows

Bandersnatch 0.4 allows remote attackers to obtain sensitive information via a malformed request for index.php with (1)

The SIP component in Ingate Firewall before 4.6.0 and SIParator before 4.6.0, when Remote NAT Traversal is employed, doe

Ability Mail Server before 2.61 allows remote authenticated users to cause a denial of service (daemon crash) via (1) ma

Group Chat in BarracudaDrive Web Server before 3.8 allows remote authenticated users to cause a denial of service (crash

Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users t

Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local user

Multiple race conditions in Smb4K before 0.8.0 allow local users to (1) modify arbitrary files via unspecified manipulat

Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thu

suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is with

gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace,

Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary fil

\Device\NdisTapi (NDISTAPI.sys) in Microsoft Windows XP SP2 and 2003 SP1 uses weak permissions, which allows local users

BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description,

The (1) getRule and (2) getChains functions in server/rules.cpp in fireflierd (fireflier-server) in FireFlier 1.1.6 allo

dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data b

sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack

iChat in Apple Mac OS X 10.4.11 allows network-adjacent remote attackers to automatically initiate a video connection to

Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated

Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component,

Cross-site scripting (XSS) vulnerability in memcp.php in XMB U2U Instant Messenger allows remote authenticated users to